Sploitus

Exploit for Event Manager PHP Script 1.0 SQL Injection

CVE-2018-6576

packetstorm · 2018-02-03

Exploit Code

MARKDOWN28 lines
## https://sploitus.com/exploit?id=PACKETSTORM:146210
# # # # #  
# Exploit Title: Event Manager PHP Script 1.0 - SQL Injection  
# Dork: N/A  
# Date: 01.02.2018  
# Vendor Homepage: http://ezcode.pt/  
# Software Link: https://codecanyon.net/item/eventmanager-php-script-admin-panel/21280741  
# Version: 1.0  
# Category: Webapps  
# Tested on: WiN7_x64/KaLiLinuX_x64  
# CVE: N/A  
# # # # #  
# Exploit Author: Ihsan Sencan  
# Author Web: http://ihsan.net  
# Author Social: @ihsansencan  
# # # # #  
# Description:  
# The vulnerability allows an attacker to inject sql commands....  
#   
# Proof of Concept:   
#   
# 1)  
# http://localhost/[PATH]/event.php?id=[SQL]  
#   
# 2)  
# http://localhost/[PATH]/page.php?slug=[SQL]  
#   
# # # # #